A communication system in which a relay apparatus relays communication among a plurality of Electronic Control Units (ECUs) that control the operations of electric devices is an example of a communication system mounted in a vehicle. In such a communication system, each of the ECUs functions as a communication apparatus, and one ECU communicates with the other ECUs via the relay apparatus. A plurality of electric devices can be made to operate cooperatively by the plurality of ECUs communicating with each other. The relay apparatus sends data received from one ECU to the other ECUs.
A control program is stored in the relay apparatus. The relay apparatus executes a relay process for relaying communication by a Central Processing Unit (CPU) executing the control program. If the control program stored in the relay apparatus has been tampered with, the relay apparatus will not send the data legitimately, and there is thus a risk that the electric devices will not operate correctly. It is thus necessary to verify that the control program is legitimate when the relay apparatus is started up.
JP 2009-259160A discloses a technique for verifying that a control program is legitimate. According to this technique, associated data pertaining to the control program is computed, and it is determined whether or not the associated data that has been computed matches one of a plurality of pieces of predetermined data stored in advance. The control program is determined to be legitimate when the associated data that has been computed matches one of the plurality of pieces of predetermined data.
Multiple protocols are used for communication in vehicles. Thus a relay apparatus including a first relay device that relays communication among a plurality of first communication apparatuses and a second relay device that relays communication among a plurality of second communication apparatuses is conceivable as the relay apparatus.
With this relay apparatus, the plurality of first communication apparatuses communicate using a first protocol and the plurality of second communication apparatuses communicate using a second protocol, for example. The first relay device is also connected to the second relay device, and the first relay device and the second relay device relay communication among the first communication apparatuses and the second communication apparatuses.
With a relay apparatus including a first relay device and a second relay device, a CPU is provided in both the first relay device and the second relay device, and the control program executed by the CPU of the first relay device is different from the control program executed by the CPU of the second relay device. In this case, it is necessary to verify both of the control programs. A relay apparatus in which both the first relay device and the second relay device have a verification function for verifying that the control programs are legitimate is conceivable as a relay apparatus that verifies the control programs in both the first relay device and the second relay device.
However, if the first relay device and the second relay device both have a verification function, there are problems in that the relay apparatus will have a large size and the manufacturing costs will increase.
Such problems are not limited to vehicle-mounted apparatuses and relay apparatuses. Similar problems arise in a vehicle-mounted apparatus including a first vehicle-mounted device in which processing is executed according to a first control program and a second vehicle-mounted device in which processing is executed according to a second control program different from the first control program.
Having been conceived in light of such circumstances, an object of the present invention is to provide a small and inexpensive vehicle-mounted apparatus including a first vehicle-mounted device and a second vehicle-mounted device, a small and inexpensive relay apparatus including a first relay device and a second relay device, and computer programs executed by the vehicle-mounted apparatus and the relay apparatus.